Weakness (CWE)

CWE-352: Cross-Site Request Forgery

Compound

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

How to prevent it (7 mitigations)

Architecture and Design

Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
For example, use anti-CSRF packages such as the OWASP CSRFGuard. [REF-330]
Another example is the ESAPI Session Management control, which includes a component for CSRF. [REF-45]
Implementation

Ensure that the application is free of cross-site scripting issues (CWE-79), because most CSRF defenses can be bypassed using attacker-controlled script.
Architecture and Design

Generate a unique nonce for each form, place the nonce into the form, and verify the nonce upon receipt of the form. Be sure that the nonce is not predictable (CWE-330). [REF-332]
Architecture and Design

Identify especially dangerous operations. When the user performs a dangerous operation, send a separate confirmation request to ensure that the user intended to perform that operation.
Architecture and Design

Use the "double-submitted cookie" method as described by Felten and Zeller:
When a user visits a site, the site should generate a pseudorandom value and set it as a cookie on the user's machine. The site should require every form submission to include this value as a form value and also as a cookie value. When a POST request is sent to the site, the request should only be considered valid if the form value and the cookie value are the same.
Because of the same-origin policy, an attacker cannot read or modify the value stored in the cookie. To successfully submit a form on behalf of the user, the attacker would have to correctly guess the pseudorandom value. If the pseudorandom value is cryptographically strong, this will be prohibitively difficult.
This technique requires Javascript, so it may not work for browsers that have Javascript disabled. [REF-331]
Architecture and Design

Do not use the GET method for any request that triggers a state change.
Implementation

Check the HTTP Referer header to see if the request originated from an expected page. This could break legitimate functionality, because users or proxies may have disabled sending the Referer for privacy reasons.

Source: MITRE CWE-352

All Critical High Medium Low Exploited only Public exploit

72 results · Clear filters · Feed

Medium 6.8

CVE-2023-49965 Public exploit

SpaceX Starlink Wi-Fi router Gen 2 before 2023.48.0 allows XSS via the ssid and password parameters on the Setup Page.

Apr 5, 2024
Medium 6.1

CVE-2024-0590 Public exploit

Microsoft Clarity <= 0.9.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The Microsoft Clarity plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9.3. This is due to missing nonce validation on the edit_clarity_project_id() function. This makes it possible for unauthenticated a…

Microsoft Microsoft Clarity Web / CMS

Feb 20, 2024
Medium 4.3

CVE-2024-0379 Public exploit

Custom Twitter Feeds – A Tweets Widget or X Feed Widget <= 2.2.1 - Cross-Site Request Forgery to Plugin Options Update

The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.1. This is due to missing or incorrect nonce validation on the ctf_auto_save_tokens function…

smub Custom Twitter Feeds – A Tweets Widget or X Feed Widget Web / CMS

Feb 20, 2024
Medium 5.3

CVE-2024-0624 Public exploit

Paid Memberships Pro <= 2.12.7 - Cross-Site Request Forgery to Level Orders Update

The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.12.7. This is due to missing or incorrect nonce validation on the …

strangerstudios Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions Web / CMS

Jan 25, 2024
Medium 4.3

CVE-2024-0623 Public exploit

VK Block Patterns <= 1.31.1.1 - Cross-Site Request Forgery

The VK Block Patterns plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.31.1.1. This is due to missing or incorrect nonce validation on the vbp_clear_patterns_cache() function. This makes it possible for …

vektor-inc VK Block Patterns Web / CMS

Jan 20, 2024
Medium 6.5

CVE-2023-45857 Public exploit

Axios Cross-Site Request Forgery Vulnerability

An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.

node-axios axios node-axios Debian Ubuntu npm

Nov 8, 2023
Medium 6.5

CVE-2023-34927 Public exploit

Casdoor Cross-Site Request Forgery vulnerability

Casdoor v1.331.0 and below was discovered to contain a Cross-Site Request Forgery (CSRF) in the endpoint /api/set-password. This vulnerability allows attackers to arbitrarily change the victim user's password via supplying a crafted URL.

github.com/casdoor/casdoor Go

Jun 22, 2023
Medium 6.5

CVE-2023-33409 Public exploit

Minical 1.0.0 is vulnerable to Cross Site Request Forgery (CSRF) via minical/public/application/controllers/settings/co…

Jun 5, 2023
Medium 4.3

CVE-2022-47447 Public exploit

WordPress WP-Advanced-Search Plugin <= 3.3.8 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in Mathieu Chartier WordPress WP-Advanced-Search plugin <= 3.3.8 versions.

Mathieu Chartier WordPress WP-Advanced-Search Web / CMS

May 24, 2023
Medium 4.3

CVE-2022-4944 Public exploit

kalcaddle KodExplorer cross-site request forgery

A vulnerability, which was classified as problematic, has been found in kalcaddle KodExplorer up to 4.49. Affected by this issue is some unknown functionality. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The expl…

kalcaddle KodExplorer

Apr 22, 2023
Medium 6.4

CVE-2022-47373 Public exploit

Reflected Cross Site Scripting in Search Functionality of Module Library

Reflected Cross Site Scripting in Search Functionality of Module Library in Pandora FMS Console v766 and lower. This vulnerability arises on the forget password functionality in which parameter username does not proper input validation/sanitization thus resul…

Artica PFMS Pandora FMS pandora Ubuntu

Feb 15, 2023
Medium 4.8

CVE-2022-47131 Public exploit

A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows an attacker to arbitrarily create a page.

Feb 3, 2023
Medium 4.3

CVE-2022-47130 Public exploit

A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows a discount coupon to be arbitrarily created if a…

Feb 3, 2023
Medium 5.2

CVE-2022-43980 Public exploit

Cross-site scripting vulnerability in the network maps edit functionality

There is a stored cross-site scripting vulnerability in Pandora FMS v765 in the network maps editing functionality. An attacker could modify a network map, including on purpose the name of an XSS payload. Once created, if a user with admin privileges clicks o…

Artica PFMS Pandora FMS

Jan 27, 2023
Medium 4.3

CVE-2022-41413 Public exploit

perfSONAR v4.x <= v4.4.5 was discovered to contain a Cross-Site Request Forgery (CSRF) which is triggered when an attac…

Nov 30, 2022
Medium 4.3

CVE-2020-23588 Public exploit

A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthent…

Nov 23, 2022
Medium 4.3

CVE-2020-23586 Public exploit

A vulnerability found in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an una…

Nov 23, 2022
Medium 6.5

CVE-2020-23589 Public exploit

A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthent…

Nov 23, 2022
Medium 6.5

CVE-2020-23593 Public exploit

A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2, Firmware Version: OP_V3.3.1-191028 allows an unauthenti…

Nov 23, 2022
Medium 6.5

CVE-2020-23590 Public exploit

A vulnerability in Optilink OP-XT71000N Hardware version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an unauthent…

Nov 23, 2022
Medium 6.5

CVE-2020-23582 Public exploit

A vulnerability in the "/admin/wlmultipleap.asp" of optilink OP-XT71000N version: V2.2 could allow an unauthenticated, …

Nov 21, 2022
Medium 6.5

CVE-2019-12922 Public exploit EPSS 11%

phpMyAdmin Cross-Site Request Forgery (CSRF)

A CSRF issue in phpMyAdmin 4.9.0.1 allows deletion of any server in the Setup page.

phpmyadmin phpmyadmin phpmyadmin/phpmyadmin phpmyadmin Debian Ubuntu Alpine Packagist

Sep 13, 2019
Medium 4.7

CVE-2019-1881 Public exploit

Cisco Industrial Network Director Cross-Site Request Forgery Vulnerability

A vulnerability in the web-based management interface of Cisco Industrial Network Director (IND) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vul…

Cisco Cisco Industrial Network Director Network devices

Jun 5, 2019
Medium 6.5

CVE-2019-12616 Public exploit EPSS 20%

phpMyAdmin CSRF Vulnerability

An issue was discovered in phpMyAdmin before 4.9.0. A vulnerability was found that allows an attacker to trigger a CSRF attack against a phpMyAdmin user. The attacker can trick the user, for instance through a broken <img> tag pointing at the victim's phpMyAd…

phpmyadmin phpmyadmin phpmyadmin/phpmyadmin phpmyadmin Debian Ubuntu Alpine Packagist

Jun 5, 2019
Medium 6.5

CVE-2018-16854 Public exploit

Moodle Login CSRF vulnerability in login form

A flaw was found in moodle versions 3.5 to 3.5.2, 3.4 to 3.4.5, 3.3 to 3.3.8, 3.1 to 3.1.14 and earlier. The login form is not protected by a token to prevent login cross-site request forgery. Fixed versions include 3.6, 3.5.3, 3.4.6, 3.3.9 and 3.1.15.

[UNKNOWN] moodle moodle/moodle moodle Web / CMS Ubuntu Packagist

Nov 26, 2018
Medium 6.5

CVE-2017-7620 Public exploit

MantisBT vulnerable to CSRF and Open Redirect attacks

MantisBT before 1.3.11, 2.x before 2.3.3, and 2.4.x before 2.4.1 omits a backslash check in string_api.php and consequently has conflicting interpretations of an initial \/ substring as introducing either a local pathname or a remote hostname, which leads to …

mantisbt/mantisbt Packagist

May 21, 2017
Medium 4.5

CVE-2017-8382 Public exploit

admidio CSRF Vulnerability

admidio 3.2.8 has CSRF in adm_program/modules/members/members_function.php with an impact of deleting arbitrary user accounts.

admidio/admidio Packagist

May 16, 2017
Medium 4.5

CVE-2016-4808 Public exploit

Web2py Cross-Site Request Forgery vulnerability

Web2py versions 2.14.5 and below was affected by CSRF (Cross Site Request Forgery) vulnerability, which allows an attacker to trick a logged in user to perform some unwanted actions i.e An attacker can trick an victim to disable the installed application just…

web2py PyPI

Jan 11, 2017
Medium —

CVE-2014-4671 Public exploit EPSS 22%

Rosetta-Flash JSONP Vulnerability in hapi

Adobe Flash Player before 13.0.0.231 and 14.x before 14.0.0.145 on Windows and OS X and before 11.2.202.394 on Linux, Adobe AIR before 14.0.0.137 on Android, Adobe AIR SDK before 14.0.0.137, and Adobe AIR SDK & Compiler before 14.0.0.137 do not properly restr…

flashplugin-nonfree hapi Ubuntu npm

Jul 9, 2014
Medium —

CVE-2012-4431 Public exploit

Cross-Site Request Forgery in Apache Tomcat

org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier.

org.apache.tomcat:tomcat Maven

Dec 19, 2012
Medium —

CVE-2009-0039 Public exploit EPSS 11%

Apache Geronimo Application Server CSRF vulnerabilities

Multiple cross-site request forgery (CSRF) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to hijack the authentication of administrators for requests that (1) change the web adm…

org.apache.geronimo.plugins:console Maven

Apr 17, 2009
Medium 6.5

CVE-2005-1674 Public exploit

Cross-Site Request Forgery (CSRF) vulnerability in Help Center Live allows remote attackers to perform actions as the a…

May 19, 2005